CVE-2023-51409

Summary of CVE-2023-51409 : The WordPress plugin “AI Engine: ChatGPT Chatbot” (ai-engine) is affected by an Unrestricted Upload of File with Dangerous Type vulnerability. From the connected documents, vulnerable versions are up to 1.9.98, with unauthenticated attackers able to upload arbitrary fi...

CVE-2024-10499

The AI Engine WordPress plugin is vulnerable to SQL injection in RESP API handling. Until version 2.6.5, an input parameter is not sanitized/escaped before use in SQL, enabling admins to perform SQL injection via the API. Affected: AI Engine (WordPress plugin) prior to 2.6.5. Root cause: unsaniti...

CVE-2024-29100

The CVE-2024-29100 entry concerns WordPress AI Engine (ChatGPT Chatbot) Plugin

CVE-2023-2580

The AI Engine WordPress plugin (pre-1.6.83) allows Stored XSS via unsanitized/unchecked settings, enabling high-privilege users (e.g., administrators) to inject scripts even when unfiltered_html is disallowed (multisite scenarios). Affected versions: prior to 1.6.83. Mitigation: update to version...

CVE-2024-0699

CVE-2024-0699 affects the WordPress plugin “AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!” up to version 2.1.4. The vulnerability is an arbitrary file upload flaw caused by missing file type validation in add_image_from_url, exploitable by authenticated attackers with Editor access...

CVE-2024-29090

CVE-2024-29090 concerns the WordPress AI Engine: ChatGPT Chatbot plugin, affected up to version 2.1.4. The vulnerability is a Server-Side Request Forgery (SSRF) in the download_image function, allowing an authenticated attacker (editor-level access or above) to cause the plugin to issue requests ...

CVE-2024-38791

CVE-2024-38791 is a Server-Side Request Forgery in the WordPress plugin AI Engine: ChatGPT Chatbot (Jordy Meow AI Engine). Affected versions are from n/a through 2.4.7. NVD lists CVSS v3.1 base score 7.1 (HIGH). Connected sources corroborate SSRF vulnerability; Wordfence/vulnerability entries ind...

CVE-2024-6723

The CVE-2024-6723 entry concerns the WordPress AI Engine plugin prior to 2.4.8. A SQL injection arises because a parameter is not properly sanitized/escaped before being used in a SQL statement, and this is exploitable by admin users when viewing chatbot discussions. Connected sources (Red Hat, P...

CVE-2024-34440

CVE-2024-34440 affects AI Engine: ChatGPT Chatbot (WordPress) up to v2.2.63, with an Unrestricted Upload of File with Dangerous Type vulnerability. Authentication requirement is indicated as Editor+ in Wordfence; exploitation could enable arbitrary file uploads. A fix has been released (patched) ...

CVE-2024-6451

CVE-2024-6451 affects the AI Engine WordPress plugin (versions < 2.5.1) and the AI Engine core (AI Engine

CVE-2025-5071

The CVE-2025-5071 entry concerns the WordPress AI Engine plugin (versions 2.8.0–2.8.3) with a missing capability check in Meow_MWAI_Labs_MCP::can_access_mcp. This allows authenticated users with subscriber-level access and above to gain full MCP control and execute commands (e.g., wp_create_user,...

CVE-2025-6238

The CVE-2025-6238 case concerns the WordPress AI Engine plugin (v2.8.4) with an insecure OAuth implementation where the redirect_uri parameter lacks validation during the authorization flow. This open redirect could allow unauthenticated attackers to intercept the authorization code and obtain an...

CVE-2025-5570

CVE-2025-5570 (AI Engine plugin for WordPress) is a stored Cross-Site Scripting vulnerability in versions up to 2.8.4, caused by insufficient input sanitization and output escaping in the mwai_chatbot shortcode with the parameter ‘id’. Exploitation requires authentication at Subscriber level or h...